Compute instances are isolated in private networks

Check ID: compute_instance_isolated_private_network
Provider: OpenStack
Service: compute
Severity: MEDIUM
Categories: trust-boundaries
Resource type: OS::Nova::Server

What this check verifies

OpenStack compute instances (VMs) are evaluated to verify network isolation by ensuring they have private IP addresses without mixed public/private exposure. Proper network segmentation requires instances to be deployed in private networks and accessed via controlled entry points (bastion hosts, VPN, load balancers) rather than direct public exposure.

Risk

Instances with mixed public/private exposure or only public IPs lack network isolation, allowing unauthorized internet access that bypasses segmentation controls. Attackers can pivot from compromised public instances to internal infrastructure for lateral movement. Flat topology exposes internal services to internet attacks including DDoS and exploit attempts.

Recommendation

Deploy instances in private networks (RFC1918) with tiered architecture: web tier with public IPs, app/database tiers private only. Never mix public and private IPs on same instance. Use bastion hosts or VPN for operator access, security groups for least-privilege policies, and NAT gateways for outbound access. Enable flow logs to detect lateral movement attempts.

Remediation

CLI
Terraform
Dashboard steps

openstack server remove floating ip <instance_id> <floating_ip>

# Terraform: deploy instance in isolated private network

# Private network (no external gateway)
resource "openstack_networking_network_v2" "private" {
  name           = "private-network"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "private_subnet" {
  name       = "private-subnet"
  network_id = openstack_networking_network_v2.private.id
  cidr       = "10.0.1.0/24"
  ip_version = 4
  # No gateway_ip means no external routing
}

# Instance in private network (no public IP)
resource "openstack_compute_instance_v2" "app_server" {
  name            = "app-server"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  security_groups = ["app-tier-sg"]

  # Attach to private network ONLY
  network {
    uuid = openstack_networking_network_v2.private.id
  }

  # Do NOT associate floating IP
}

# Security group for app tier (least privilege)
resource "openstack_networking_secgroup_v2" "app_tier_sg" {
  name        = "app-tier-sg"
  description = "App tier security group - private network only"
}

# Allow SSH from bastion host only (not internet)
resource "openstack_networking_secgroup_rule_v2" "app_ssh_from_bastion" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = var.bastion_private_ip  # e.g., 10.0.0.5/32
  security_group_id = openstack_networking_secgroup_v2.app_tier_sg.id
}

# Allow app traffic from web tier only
resource "openstack_networking_secgroup_rule_v2" "app_backend" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 8080
  port_range_max    = 8080
  remote_ip_prefix  = var.web_tier_cidr  # e.g., 10.0.2.0/24
  security_group_id = openstack_networking_secgroup_v2.app_tier_sg.id
}

References

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_isolated_private_network. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to OpenStack checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires